@lunora/server 1.0.0-alpha.11 → 1.0.0-alpha.13

package/dist/index.mjs

@@ -17,11 +17,11 @@ export { defineShape } from './packem_shared/defineShape-CJ27Wx7o.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
-export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-1jexWrb3.mjs';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-Do1CSBTr.mjs';
 export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
 export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
-export { mask } from './packem_shared/mask-BV_jNzsN.mjs';
-export { rls } from './packem_shared/rls-2Jhd0uev.mjs';
+export { mask } from './packem_shared/mask-E8MgAS3N.mjs';
+export { rls } from './packem_shared/rls-DhNgKFeW.mjs';
 export { storageRules } from './packem_shared/storageRules-Cje6Woea.mjs';
 
 const VERSION = "0.0.0";

package/dist/packem_shared/{buildRlsReadRegistry-1jexWrb3.mjs → buildRlsReadRegistry-Do1CSBTr.mjs}

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-2Jhd0uev.mjs';
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-DhNgKFeW.mjs';
 import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
 
 const FALSE_PREDICATE = { OR: [] };

package/dist/packem_shared/{mask-BV_jNzsN.mjs → mask-E8MgAS3N.mjs}

@@ -46,6 +46,29 @@ const maskRow = (row, columns, base) => {
 const maskPage = (page, columns, base) => {
   return { ...page, page: page.page.map((row) => maskRow(row, columns, base)) };
 };
+const assertIndexFieldsAllowed = (builderCallback, columns, tableName, method) => {
+  if (typeof builderCallback !== "function") {
+    return;
+  }
+  const referenced = /* @__PURE__ */ new Set();
+  const makeRecorder = () => /* @__PURE__ */ new Proxy(
+    {},
+    {
+      get: () => (field) => {
+        if (typeof field === "string") {
+          referenced.add(field);
+        }
+        return makeRecorder();
+      }
+    }
+  );
+  builderCallback(makeRecorder());
+  for (const field of referenced) {
+    if (field in columns) {
+      throw new LunoraError("MASK_UNSUPPORTED", `${method}() filtering "${tableName}" by masked column "${field}" is not supported`);
+    }
+  }
+};
 const isFacadeEntry = (value) => {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -54,21 +77,27 @@ const isFacadeEntry = (value) => {
   return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
 };
 const wrapDatabase = (base, perTable, context) => {
-  const wrapReader = (reader, columns) => {
+  const wrapReader = (reader, columns, tableName) => {
     return {
       collect: async () => {
         const rows = await reader.collect();
         return rows.map((row) => maskRow(row, columns, context));
       },
+      // SECURITY (value oracle): the predicate must see the MASKED row, not
+      // the raw stored row — otherwise a caller can `.filter(d => d.ssn ===
+      // guess)` to read the value the mask hides. Masking before the
+      // predicate keeps filtering on non-masked columns working while
+      // redacting masked cells the predicate can observe.
       filter: (predicate) => wrapReader(
-        reader.filter((document) => predicate(document)),
-        columns
+        reader.filter((document) => predicate(maskRow(document, columns, context))),
+        columns,
+        tableName
       ),
       first: async () => {
         const row = await reader.first();
         return row ? maskRow(row, columns, context) : null;
       },
-      order: (direction) => wrapReader(reader.order(direction), columns),
+      order: (direction) => wrapReader(reader.order(direction), columns, tableName),
       paginate: async (options) => maskPage(await reader.paginate(options), columns, context),
       take: async (limit) => {
         const rows = await reader.take(limit);
@@ -78,8 +107,19 @@ const wrapDatabase = (base, perTable, context) => {
         const row = await reader.unique();
         return row ? maskRow(row, columns, context) : null;
       },
-      withIndex: (indexName, range) => wrapReader(reader.withIndex(indexName, range), columns),
-      withSearchIndex: (indexName, search) => wrapReader(reader.withSearchIndex(indexName, search), columns)
+      // SECURITY (value oracle): reject before delegating when the range /
+      // search references a masked column — an index range or search term
+      // over a masked column is the same value oracle as a masked-column
+      // `where`, so it must fail closed (see `assertIndexFieldsAllowed`).
+      // Reads over NON-masked columns pass through and still mask output.
+      withIndex: (indexName, range) => {
+        assertIndexFieldsAllowed(range, columns, tableName, "withIndex");
+        return wrapReader(reader.withIndex(indexName, range), columns, tableName);
+      },
+      withSearchIndex: (indexName, search) => {
+        assertIndexFieldsAllowed(search, columns, tableName, "withSearchIndex");
+        return wrapReader(reader.withSearchIndex(indexName, search), columns, tableName);
+      }
     };
   };
   const locate = async (id, expectedTable) => {
@@ -120,23 +160,63 @@ const wrapDatabase = (base, perTable, context) => {
       throw new LunoraError("MASK_UNSUPPORTED", `${method}() over masked column "${offending}" on "${tableName}" is not supported`);
     }
   };
+  const collectWhereFields = (where, into) => {
+    if (!where || typeof where !== "object" || Array.isArray(where)) {
+      return;
+    }
+    for (const [key, value] of Object.entries(where)) {
+      if (key === "AND" || key === "OR") {
+        if (Array.isArray(value)) {
+          for (const clause of value) {
+            collectWhereFields(clause, into);
+          }
+        }
+      } else if (key === "NOT") {
+        collectWhereFields(value, into);
+      } else if (!key.startsWith("__")) {
+        into.add(key);
+      }
+    }
+  };
+  const assertWhereAllowed = (tableName, where, method) => {
+    const columns = perTable.get(tableName);
+    if (!columns || where === void 0) {
+      return;
+    }
+    const referenced = /* @__PURE__ */ new Set();
+    collectWhereFields(where, referenced);
+    for (const field of referenced) {
+      if (field in columns) {
+        throw new LunoraError("MASK_UNSUPPORTED", `${method}() filtering "${tableName}" by masked column "${field}" is not supported`);
+      }
+    }
+  };
   const wrapped = {
     ...base,
     aggregate(tableName, options) {
       assertReductionAllowed(tableName, [options.field], "aggregate");
       return base.aggregate(tableName, options);
     },
+    count(tableName, whereOrArgs) {
+      const wrapper = whereOrArgs && typeof whereOrArgs === "object" && !Array.isArray(whereOrArgs) ? whereOrArgs : void 0;
+      const where = wrapper && ("where" in wrapper || "baseWhere" in wrapper || "restrictsCounts" in wrapper) ? wrapper.where : whereOrArgs;
+      assertWhereAllowed(tableName, where, "count");
+      return base.count(tableName, whereOrArgs);
+    },
     async findFirst(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findFirst");
       const row = await base.findFirst(tableName, args);
       const columns = perTable.get(tableName);
       return row && columns ? maskRow(row, columns, context) : row;
     },
     async findFirstOrThrow(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findFirstOrThrow");
       const row = await base.findFirstOrThrow(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskRow(row, columns, context) : row;
     },
     async findMany(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findMany");
       const page = await base.findMany(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskPage(page, columns, context) : page;
@@ -156,7 +236,7 @@ const wrapDatabase = (base, perTable, context) => {
     query(tableName) {
       const reader = base.query(tableName);
       const columns = perTable.get(tableName);
-      return columns ? wrapReader(reader, columns) : reader;
+      return columns ? wrapReader(reader, columns, tableName) : reader;
     },
     async rankPage(tableName, indexName, options) {
       const page = await base.rankPage(tableName, indexName, options);

package/dist/packem_shared/{rls-2Jhd0uev.mjs → rls-DhNgKFeW.mjs}

@@ -245,7 +245,6 @@ const isFacadeEntry = (value) => {
   return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
 };
 const wrapDatabase = (base, raw, perTable, context) => {
-  const route = (tableName) => perTable.has(tableName) ? raw : base;
   const readBaseCache = /* @__PURE__ */ new Map();
   const readBase = (tableName) => {
     const cached = readBaseCache.get(tableName);
@@ -263,6 +262,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
     readBaseCache.set(tableName, result);
     return result;
   };
+  const route = (tableName) => readBase(tableName).restricts ? raw : base;
   const relationReadFilter = (table) => readBase(table).baseWhere;
   const locateRow = async (id, expectedTable) => {
     if (raw.lookupById) {
@@ -300,7 +300,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
       const nextRow = computeNextRow ? computeNextRow(located.row) : void 0;
       const writeOk = evaluateWrite(policies, op, { ...context, row: located.row }, nextRow);
       if (!writeOk) {
-        throw new LunoraError("FORBIDDEN", `${op} on "${located.tableName}" denied by policy`);
+        throw new LunoraError("FORBIDDEN", `${op} denied by policy`);
       }
     }
     return perform(raw);
@@ -366,7 +366,10 @@ const wrapDatabase = (base, raw, perTable, context) => {
         return base.get(id, expectedTable);
       }
       const { baseWhere, restricts } = readBase(located.tableName);
-      if (!restricts || !baseWhere) {
+      if (!restricts) {
+        return base.get(id, expectedTable);
+      }
+      if (!baseWhere) {
         return located.row;
       }
       const allowed = await raw.findFirst(located.tableName, { baseWhere, limit: 1, where: { _id: id } });

package/dist/rls/testing.mjs

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-2Jhd0uev.mjs';
+import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-DhNgKFeW.mjs';
 
 const expectPolicy = (policies, options = {}) => {
   const rolePermissions = indexRolePermissions(options.roles);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.13",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",